CVE-2026-55202highCWE-290

CVE-2026-55202: falha de alta gravidade em tinyproxy

Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar tinyproxy+ Monitorar tinyproxy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.4%
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
tinyproxy · tinyproxy
CVEs relacionadas — tinyproxy

No mesmo produto, das mais perigosas para as menos.

CVE-2026-3945HIGHtinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of ServiceEPSS 0.6%CVE-2026-54388CRITICALTinyproxy - HTTP Request Smuggling via Duplicate Content-Length HeadersEPSS 0.4%CVE-2026-54387CRITICALTinyproxy - HTTP Request Smuggling via CL/TE DesynchronizationEPSS 0.4%CVE-2026-125371MEDIUMTinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix MatchEPSS —